Security Advisory: PHP2Shell, Two Critical PHP Remote Code Execution Flaws
PHP: Hypertext Preprocessor (PHP) has two critical remote code execution (RCE) flaws, tracked as Common Vulnerabilities and Exposures (CVE) CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated 9.2 and reportedly exploitable by unauthenticated attackers. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older get no patch.
Learn More about Security Advisory: PHP2Shell, Two Critical PHP Remote Code Execution Flaws
